Users moving from one cryptocurrency wallet to another face a critical decision: should they import their existing private keys into Guarda, or generate new keys within Guarda and manually transfer their assets? The answer depends on how the original wallet was created, whether its security has been compromised, and whether Guarda’s key derivation path is compatible with the source. A Guarda wallet download followed by careless key import can expose funds to loss or theft far more reliably than keeping them in the original application. The safer path usually requires understanding what private keys actually are and when importing them makes sense.

This distinction matters because non-custodial wallets like Guarda give users direct control of their cryptographic material in exchange for direct responsibility for securing it. If a private key was generated on a compromised device, imported into a cloud backup, or stored in plain text anywhere, importing it into a new wallet does not fix the underlying exposure. Conversely, if a wallet has been used carelessly, leaving transaction trails or allowing address reuse, starting fresh with a new recovery phrase and deliberate asset movement can reduce the risks created by past behavior. The practical task is to evaluate which approach closes the relevant security gaps without creating new ones.

Private key storage and the import question

A private key is the cryptographic credential that proves ownership of an address and authorizes transactions. It does not exist in only one place: it exists in every place where someone wrote it down, took a screenshot, stored it in a password manager, or transmitted it over a network. When a user plans to import a private key into Guarda, they are not moving a single secure object. They are choosing to have Guarda store a credential that may have been exposed during its entire history in the previous wallet.

The first step in evaluating an import is therefore to reconstruct how the original private key was generated and handled. If it was created within a reputable wallet application on a clean device, never exported or backed up to an online service, and accessed only through that device’s security environment, the risk profile is manageable. If the original wallet was used on a borrowed or shared computer, if backups were saved to cloud storage, if the key was ever copied to a text editor or screenshot app, or if the device has been exposed to malware, importing that key guarantees that Guarda will now be storing a compromised credential.

Recovery phrase import is different from private key import in an important way. A recovery phrase is a list of words that can regenerate all the keys associated with a wallet using a standardized process called HD (Hierarchical Deterministic) derivation. If the original wallet was an HD wallet—which most modern wallets are—then the recovery phrase itself is the master secret. Guarda supports recovery phrase import for most cryptocurrencies because the phrase can be used to generate the same sequence of keys and addresses. This is generally safer than importing individual keys, because it avoids creating a copy of the private key in the source wallet’s format and then translating it into a different format.

However, recovery phrase import still carries a precondition: the original device and recovery phrase must not be actively compromised. If malware stole the recovery phrase, importing it into Guarda means the malware operator now has a direct path to the new wallet. If the phrase was written down carelessly or stored digitally, anyone who finds that copy can regenerate the wallet. The device where recovery phrase import happens—usually a phone, computer, or browser after a Guarda wallet download—must be treated as the new sensitive environment from that moment forward.

When to start fresh instead of importing

Starting fresh means generating a completely new recovery phrase within Guarda, then manually transferring assets from the old wallet to the new one. This approach is slower and more expensive (it requires network fees), but it creates a clean break with past wallet behavior and any keys that may have been exposed. The decision to start fresh should be made if any of the following are true: the original device has shown signs of compromise such as unexpected password changes, unfamiliar applications, or suspicious network traffic; the recovery phrase or private key was ever stored on a cloud service, email account, or phone backup; the wallet was used on a shared computer or in an untrusted network environment; or the user cannot definitively establish when and how the original keys were created.

Starting fresh is also the safer choice if the original wallet has been dormant or its backup procedure is uncertain. If a user cannot locate a backup, cannot remember the backup method, or suspects that a recovery phrase may have been written down more than once, creating new keys eliminates the ambiguity. The cost is the transaction fees required to move funds; the benefit is that the new wallet is guaranteed to have a recovery phrase that exists only where the user puts it.

The mechanics of moving assets between wallets are straightforward but require attention to detail. Within Guarda Wallet, the user would view their receiving address for a given cryptocurrency, then initiate a send transaction from the old wallet to that address. For Bitcoin, Ethereum, or other widely supported cryptocurrencies, this is reliable and routine. The confirmation times depend on the network and fee level selected. A common mistake is rushing and copying the address incorrectly, sending to the wrong network, or using a fee so low that the transaction sits unconfirmed for days. Take extra time to verify the destination address, confirm the blockchain, and check that the old wallet is actually sending (rather than merely preparing) before considering the transfer started.

One practical signal that starting fresh is the right choice is when a user cannot accurately describe how their original wallet was backed up. If they know they have a recovery phrase but cannot locate it, or they know it exists but are not certain whether it is in a notebook, an email draft, or both, that uncertainty is itself a reason to abandon the old keys and create new ones. A Guarda wallet download and fresh recovery phrase generation creates a known starting point. The recovery phrase can be written down carefully, stored offline, and tested in a controlled way before the wallet becomes a active part of the user’s financial routine.

Guarda wallet download and HD wallet derivation paths

Guarda uses standard HD wallet derivation, which means it generates addresses using a reproducible mathematical formula applied to the recovery phrase. This is how most modern wallets work, and it makes recovery phrase import relatively simple—as long as the source wallet also used the same standard. If a user imports a recovery phrase from a wallet that used a non-standard derivation path, Guarda may not generate the same addresses and account balances may not appear. A careful user would test this with a small amount first or verify that the original wallet’s documentation aligns with the BIP-44 or similar standards that Guarda follows.

Guarda’s multi-platform availability—as a desktop application, mobile app, web interface, and browser extension—means that the recovery phrase can be restored on any of these versions after a Guarda wallet download. The private keys are regenerated using the same phrase, regardless of the platform. This is convenient for access but it also means that if the recovery phrase is compromised, every platform becomes vulnerable automatically. Users should not share the recovery phrase between devices lightly or assume that because Guarda is web-based on one platform it is less secure than a desktop version. The security boundary is the recovery phrase itself, not the application’s form factor.

For cryptocurrencies that Guarda supports, including Bitcoin, Ethereum, Litecoin, Polygon, Avalanche, Binance Coin, and hundreds of others, the derivation path and address format should be compatible with standard wallets. If a user has previously used a wallet from a very small or non-standard provider, compatibility is less certain. Before committing funds, a user could restore the recovery phrase in Guarda on a non-production device or testnet, verify that the same addresses appear, and only then move funds. This verification step takes time but prevents the expensive mistake of moving funds to what appears to be a restored wallet but actually generates different addresses.

Device-level encryption and the risk of the import process itself

A Guarda wallet download onto a phone or computer involves installing software that will handle cryptographic material locally. Device-level encryption, if enabled through the operating system (such as iOS’s Secure Enclave or Android’s TEE), can protect the stored keys against casual access if the device is stolen. Password protection within Guarda adds another layer. However, these protections are only as strong as the device itself. A computer or phone with active malware, root-level compromise, or a sophisticated attacker with physical access can circumvent encryption.

The import process is particularly sensitive because it requires the private keys or recovery phrase to be entered into the application. On a compromised device, a malware keylogger could capture the recovery phrase as it is being typed. A fake Guarda application downloaded from the wrong source could display an innocent-looking import screen while transmitting keys to an attacker. Before importing anything, a user should verify that they downloaded Guarda from the official source, check that the application’s signature or certificate matches the official repository, and preferably use a device that is not actively infected or suspected to be compromised.

After the import is complete, the recovery phrase itself becomes a liability if it is not stored safely. Writing the phrase on paper and storing it in a locked drawer is the most conventional method. A more sophisticated approach involves splitting the phrase into parts stored in separate locations, or memorizing a portion of it and storing only the remainder. The key principle is that whoever has the recovery phrase has the wallet. If the device is later cleaned or lost, the phrase can restore the wallet on a new device—but an attacker with the phrase can also restore the wallet to a device they control.

Import versus new generation for NFT and token management

Guarda supports NFT management and stores NFTs alongside cryptocurrency. If the original wallet held NFTs and the user wants to retain them without buying and selling, importing the recovery phrase is often the fastest path, since NFTs are tied to their addresses and re-creating those addresses within Guarda through import allows the NFT to appear in the new wallet automatically. However, this also means that any security issues with the original keys apply to the NFTs as well. If the keys were compromised, so were the NFTs.

For users who want to take explicit control of their NFTs—perhaps moving them to a new address, changing collection strategies, or removing them from the old recovery phrase entirely—the starting-fresh approach involves selling or transferring the NFTs from the old wallet to new addresses within the new Guarda wallet. This requires the old wallet to still be accessible and capable of sending transactions. Depending on blockchain fees and market conditions, this can be expensive. But it creates a clear separation: old keys, old addresses, old NFTs are left behind, and the new wallet contains only assets that were explicitly transferred there by the user.

The same logic applies to staking positions and any cryptocurrency locked in contracts or protocols. If the original wallet had tokens staked for yield, those tokens are attached to the original address until unstaked. Importing the recovery phrase into Guarda will allow the user to see the staking position and potentially claim rewards, but the tokens cannot be moved until they are unstaked in the staking protocol itself. The Guarda interface displays staking options for select cryptocurrencies, but it does not automatically migrate staking rewards or change which address is earning yield. Users should understand the steps required to unstake and re-stake in the new wallet before assuming that an import will make everything available in the new environment.

Practical step-by-step verification before committing funds

Before transferring substantial amounts into a Guarda wallet—especially after an import—a user should follow a verification sequence. First, locate and write down the recovery phrase that Guarda generates upon creation or import. Do not store this digitally yet. Second, on a separate device or the same device after clearing the Guarda installation, restore the wallet using only the recovery phrase and verify that the same addresses appear. This tests whether the recovery phrase is valid and whether Guarda can regenerate the wallet correctly. Third, send a small amount of cryptocurrency to one of the derived addresses and confirm that it arrives and is visible in Guarda.

Only after successful small-amount testing should the user move larger balances. This approach applies whether the user is starting fresh or importing. A fresh start with a new recovery phrase should be tested before the phrase is deleted and any funds are transferred in. An import of an old recovery phrase should be tested before old balances are moved. The test does not guarantee that the wallet is secure—security depends on device condition, password strength, and recovery phrase storage—but it does verify that the wallet is functional and that the import or generation actually worked.

For users who have previously used multiple wallets or who are migrating assets from several sources, a structured approach is helpful. Create one prioritized list of the old wallets and their balances. For each old wallet, decide: import the recovery phrase into Guarda, or start fresh and transfer manually? Document the decision and the reason. If importing, test first on a clean device and with a small amount. If starting fresh, generate a new Guarda wallet, test it, move a small amount, and only then transfer the remainder. This methodical process is slower than dragging and dropping a recovery phrase file, but it eliminates most of the common failure modes.

After migration: storing the recovery phrase and managing access

Once funds are in Guarda and the wallet is confirmed to be working, the recovery phrase becomes the long-term security anchor. Many users make the mistake of treating the phrase as something to be stored once and ignored thereafter. In reality, the recovery phrase is the most important artifact and requires ongoing care. It should be stored in a location that is secure against theft, fire, flood, and unauthorized access. A safe deposit box, a home safe, or a secure physical backup divided among trusted locations are all reasonable approaches.

Users should also prepare for the scenario in which they need to access the wallet on a new device without the original. This means testing the recovery process before emergencies occur. On a fresh device, or on a different operating system than the usual one, download Guarda, select restore from recovery phrase, and walk through the process using the written phrase. Confirm that the expected addresses and balances appear. This test should be done periodically—perhaps annually—to ensure that the recovery process is still familiar and that the user has not forgotten any details.

Finally, users should clarify whether they want the recovery phrase to be known to anyone else. Some users prefer to have a spouse, trusted friend, or attorney know the location and access method as insurance against death or incapacity. Others prefer total secrecy. There is no universal right answer, but the user should make an intentional choice rather than leaving it ambiguous. If the recovery phrase is known to another person, that person now has custody of the funds in a cryptographic sense, even if they never use that access. This is a trust relationship that should be explicit.